Privacy policy

Last updated 19 October 2026

This policy explains what NOWAY MOBILE OÜ (“we”) collects when you use unlayers.com, why, who processes it and what you can ask us to do with it. The short version: we keep what is needed to run your account, convert your images and take payment, we do not sell personal data, and you can ask us to delete everything at any time.

What we collect

• Images you upload and the layers made from them, plus the edits you save in a project. They are stored so your projects stay available to you.
• Account details: your email address, a salted hash of your password if you set one, and your Google account identifier if you sign in with Google. One-time sign-in codes are stored only as hashes and expire after 10 minutes.
• Purchases: which plan or credit pack you bought, when, in which currency, and your Stripe customer and subscription identifiers. We never see or store your card number; Stripe does.
• Technical data: your IP address and the country Cloudflare derives from it (used to show local prices and to limit abuse), browser type, and the language your browser prefers.
• Usage data through Mixpanel and the Meta Pixel, described below.

Why we use it

• To convert your images and show you the result (performance of the contract with you).
• To keep you signed in, send sign-in codes and tell you by email when a conversion is ready (contract).
• To take payment, grant credits and handle renewals, cancellations and refunds (contract and legal obligations).
• To prevent fraud and abuse, for example by rate-limiting sign-in attempts (legitimate interest).
• To understand how the product is used and measure our advertising (consent where the law requires it, otherwise legitimate interest).

Services that process data for us

• Cloudflare hosts the site, the database, the image storage and sends our emails.
• fal.ai running Bria’s layer model receives the image you upload in order to split it into layers. The provider keeps the result only briefly; we copy the layers to our own storage straight away.
• Stripe handles checkout, cards, PayPal and invoices. Stripe’s own privacy policy applies to the payment itself.
• Google (Firebase Authentication) verifies your Google account when you choose “Sign in with Google”.
• Mixpanel records product analytics, including replays of public pages. Your photos, project names and email are blocked from replays and inputs are masked.
• Meta (Facebook) Pixel and Conversions API measure whether our ads led to a visit or a purchase. For purchases we send Meta a hashed version of your email together with the Pixel cookies, never your image.

Some of these providers operate outside the European Economic Area. Where that is the case, transfers rely on the providers’ standard contractual clauses or adequacy decisions.

Cookies

• Session cookie: keeps you signed in for up to 30 days.
• lang: remembers the language you picked in the footer (one year).
• consent: remembers whether you accepted or declined analytics and ad measurement (six months). Visitors from the EEA, the UK and Switzerland are asked before anything else is set.
• _fbp, _fbc (Meta) and mp_* (Mixpanel): set only after analytics load, used to recognise return visits and attribute ads.

You can withdraw consent by deleting the consent cookie in your browser; the question is then asked again on your next visit.

How long we keep it

• Projects, uploaded images and layers: until you delete the project or ask us to delete your account.
• Account data: until you ask us to delete the account. Sign-in attempts and codes: at most 15 minutes after they expire.
• Purchase records: as long as tax and accounting law requires, typically 10 years.
• Server logs: a few days, for troubleshooting.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, or to receive it in a portable format, and you can object to processing based on legitimate interest. Write to support@unlayers.com from the address on your account. If you are in the EEA or the UK, you can also complain to your local data protection authority.

Children

Unlayers is not directed at children under 16 and we do not knowingly collect their data.

Changes

We will update this page when our practices change and note the date at the top. Material changes are announced on the site.

Contact

NOWAY MOBILE OÜ (registry code 17201091), Tornimäe tn 5, 10145 Tallinn, Estonia · support@unlayers.com